Category: Apple

Now in a new 7mm slimline form factor, and Advanced Format specification, the HTS5450 hard drive is proving a popular choice for vendors with limited space. The drives are especially popular in Ultra thin laptops and slim portable external cases. Now being manufactured by Western Digital under the brand name of HGST, the 500GB boasts just a single media platter to store all that data. Part of the redesign also brings Advanced Format to these drives. Certain older operating systems such as Windows XP require the use of the HGST Align Tool provided by Western Digital. Users of the latest OS X systems and Windows 7+ do not require the use of this Tool.

Advanced Format has been introduced to cram more data on a single platter. To do this the manufacturer has increased the standard 512 byte sector size to a 4096 byte sector. This format design also incorporates better data integrity, hopefully giving the customer all round better performance and reliability.

Plenty of shops will sell you a “Mac Hard Drive” but there is no reason why you cannot use a windows format drive on a Mac. You just need to format it first. There was once a time when a drive was specially formatted by Apple to use on their Macs, but these days Apple use the same hard drives as everyone else. To use with the latest versions of OS X I would recommend following the steps below.

NOTE: Formatting your drive will destroy all the data. Make sure there’s nothing on there you need.

1. First attach the drive to your Mac. The Mac will notify you with a small finder window to initialise the drive. See below.

Initialize Your Drive For A Mac

2. Once you have clicked initialize you will see the Disk Utility Application window. See below.

Mac Disk Utility

3. You need to select the drive you want to format in the left hand window of the utility as highlighted in blue. Internal drives show as grey and external drives show as yellow. At this point make sure you choose the correct drive, the utility will not allow you to format the internal boot drive. See below.

Drive selected

4. Now choose the Partition Tab. See below.

Partition Tab

5. Now click on the Partition Layout drop down bar and choose the first option “1 Partition”. Also to the right under Partition Information give your drive a name and below that choose the partition type you want which will be Mac OS Extended ( journaled ). We are nearly there. You now need to click on the options tab in the bottom left of the utility window and choose GUID Partition Table and click okay. As you will read in the text information, this allows the drive to be used with all current OS X Macs. See Below.

Options Tab

7. Now all you need to do is click the apply button as shown in red below.

Apply

8. Another window will appear asking for confirmation to partition the drive. Click partition. See below.

Partition Drive

9. A formatting window with a progress bar will now appear and then disappear when done. You will now see your named drive in the left window, which means that your drive is now formatted. Close the disk utility and the hard drive is ready to use. See below.

We have been offering Apple Mac Data Migration as a service for many years now. Here’s a quick reminder about this service which we call Mac Setup. You are bound to be over the moon when you are told that we have recovered your lost data, but in many cases this is only half the battle.

We wrote a detailed blog on the subject back in November 2011, but it still appears to trouble many customers.

We still often get the questions: “What do I do with the recovered data once I receive it?” and “How do I get the data back into it’s original places on my Mac?” For out-of-warranty Macs, this is where our Mac Setup comes into play. For a fixed cost we will provide you with a new installed hard drive, with all your recovered data migrated into it’s original locations, so that when you receive your Macintosh computer back, hey presto! it’s as if your Mac had never failed in the first place, everything up and running as it was.

Hardware

When developing our iPhone data recovery process we had to make a few decisions about the devices we can support. The newer iPhones (4s +) are not accessible in the same way as older models.

With the iPhone 4 and below we can extract the data using a forensically clean process. What this means is that we can take the data off without writing anything to the NAND chips (storage) inside the iPhone. This fits in perfectly with our regular data recovery process as we never write data to a device we receive.

With the iPhone 4s, Apple changed the part of the system we use to access the iPhone’s memory. There is a chance that a new method of extraction for iPhone 4s will become available, but until it does we will not be recovering files from these devices.

Physical damage

iPhones store their data on NAND chips which are soldered to the main circuit board of the phone. The data can only be correctly decoded if we also have access to other parts of the circuit board, so it is crucial that the iPhone is electronically functional. If water damage has shorted the iPhone then we have no way to access the data externally. It’s not that it’s impossible, just that the work would be unreasonably expensive and time consuming.

Deleted Files

Another potential barrier for iPhone recovery is down to the way files are stored. Since iOS4 most files including iPhone camera photos and videos are encrypted before being written to storage, using unique encryption keys. This means every file ends up with a different header. When files are deleted there is nothing to distinguish a photograph from any other random collection of bytes.

Another problem with the file based encryption is that if you restore the iPhone using iTunes, those encryption keys get erased and new ones are generated. This prevents recovery of the old data, which is good for security but bad for data recovery.

Apple have recently announced a recall program for all iMacs with internal 1TB Seagate Hard Drives. These hard drives fail unexpectedly with no prior warning. We noted the failure of these hard drives in a post back in 2009. You can check whether your iMac has an internal 1TB Seagate Hard Drive by entering your iMac Serial Number at this link.

This recall program has now ended. If you have one of these hard drives that has failed you may be interested in our Mac Data Recovery Services.

This immense 2TB iMac drive may be heavy, but have you ever wondered why?

HDS722020ALA330 2TB iMac Drive

When we recover these drives we often have to work on individual heads. As you can see from the image, this monster has 10 heads (the first is numbered zero). This means there are 5 spinning disks inside the drive.

From the outside, the only clue that these drives are so rammed full of disks is their weight. They are no bigger physically than any other desktop hard drive.

In the vast majority of cases, deleted data is actually still lurking around on your hard drive. If you put data in the Recycle Bin or Trash, and them empty it, all you are actually doing is telling the system that it can reuse those parts of the disk when it wants. Until you replace those areas with new data, the old data will still be there.

The Filing Cabinet

The tried and trusted analogy is of a filing cabinet. When you delete a file, you are removing the index card from the front of the drawer, but the actual file is still in there.

This is why it is really important to switch off your computer as soon as possible if you have accidentally deleted some files. You may not realise but even small actions like checking e-mail or browsing the internet can write cache files to the disk. That is when data could be lost.

Overwritten / Deleted Data

We often hear about the FBI being able to recover overwritten files. While this may have been possible on very old – low capacity hard drives (~100MB), it is unlikely to be possible on modern hard drives. The magnetic material is far too densely packed. Even then, it would only be tiny fragments of data recovered, and not whole files.

The Problem With SSDs

Solid state drives bring a whole new problem of their own. Due to the way the data is distributed around the device, known as wear levelling, you can never be sure of which sector you are writing or overwriting. Wear levelling is necessary to prolong the life of an SSD, but it means the drive could be moving data around behind the scenes, making deleted files much more difficult to track down.

Specifics

In most cases, we can recover deleted files with the original file names and folders. With deleted Mac data, this is often not possible. In that case we have to use a special type of scan, which finds all files of a given type and saves them to numbered files. This means camera photos may be recovered into a JPG folder, with files named like photo0001.jpg, photo0002.jpg and so on.

If required we can process certain types of these files into more meaningful order. For photos we can arrange into folders by date taken, and for music files we can arrange into Artist / Album order.

The Important Bit

If you accidentally delete some files, they are likely to be recoverable. It’s the actions you take next which can make the recovery difficult – if not impossible.

My main computer is an old MacBook Pro. I often download Linux ISOs to install on other computers. In recent Debian-esque releases this is actually really simple.

1. I find it quicker and easier to install from USB so first insert a USB pen / stick of some sort.

Note: This USB stick will be erased, so don’t use one with data that you need to keep!

2. Next we need to find out which number has been assigned to the USB stick. If you only have one disk in your Mac then the USB will usually be disk1, but always check first. (Note: Disks are numbered from zero, so your internal drive should be disk0) On your Mac open Disk Utility, which is located within Applications / Utilities. (See Image)

Disk Utility

Select the USB stick from the lefthand window and then click the Info button which is on the toolbar. (See Image)

USB Info

You will get a pop up window with loads of information about the device. We only need the Disk Identifier. Make a note of this for later.

Disk Identifier

3. To allow us to write data to the USB stick we need to unmount any volumes currently on there. (see image)

Unmount USB

4. Now comes the actual writing. First locate the Terminal application, again within Applications / Utilities. (see image)

Mac Terminal

5. Remember to change the code to match your Disk Identifier from earlier. There are a few things to note about the following command.

sudo – allows you to run dangerous commands, so will require an administrator password

Instead of typing the location of the ISO file you can just drag the ISO onto the terminal when required.

When we found out the Disk Identifier, it was disk1. That will work in the command, but we use rdisk1 instead, which gives us raw access to the disk. This may not be necessary, but it works for me.

There is a lot of discussion about block sizes, but I find 4MB is reasonable for writing ISOs to USB. In Linux we often type bs=4M, however the Mac prefers it like bs=4096 instead. It’s the same thing, just expressed differently.

The command:

sudo dd if=[drag iso here] of=/dev/r[disk number] bs=4096; sync

Example:

sudo dd if=/Users/dan/Desktop/linux.iso of=/dev/rdisk1 bs=4096; sync

If you’ve got it right, you shouldn’t get any feedback until it finishes. Your USB stick may have a blinking LED whilst the data is being written. For reference the 200MB debian-netinst ISO took just over a minute to write.

We have just completed a complex data recovery, where a Mac system had been inadvertently overwritten with Windows. The Mac drive originally had over 500GB of data, so we expected to get most of it back, we just didn’t know how good the structure would be.

It helps to visualise the layout of the data on the disk. before it was overwritten, the data would have looked something like this:

Although the fresh Windows system is much smaller than the original data, it prevents you from seeing any of that old Mac data.

Once we made copies of the drive, we were able to reconstruct the missing parts of the Mac data, and could see all the original files and folders, with their original structure.

Luckily nobody had tried to fix the problem with this drive. Often the fixes people attempt are worse to recover from than the original problems.

We see various types of camera media come into us for data recovery, with surprisingly varied file formats. Many camera manufacturers use their own raw format, alongside various JPG options.

This raw format is sometimes known as a digital negative, containing (mostly) untouched data straight from the camera. These raw format images can be ten times the size of JPG images.

The benefits of raw files are to allow post-processing without the loss of quality from JPG files. Settings like sharpness, saturation and white balance can be changed at a later date using photographic software. Below are a few of the different raw file types in use.

The following is a description about some RAW formats:

CRW – Canon Digital Camera Raw Image Format. Raw image format for some Canon digital cameras. Raw images are basically the data as it comes directly from the CCD detector in the camera. Raw files can also contain text information about the picture and conditions in the camera when the picture was taken.

CR2 – Canon Digital Camera Raw Image Format version 2.0. Raw files can also contain text information about the picture and conditions in the camera when the picture was taken. These images are based on the TIFF image standard.

RAF – Fuji CCD-RAW Graphic File. Exif (Exchangeable Image File) information is within the file along with the image.

X3F – Sigma Camera RAW Picture File. Use the SIGMA Photo Pro software provided with the camera to download and manipulate the photos. The Foveon X3 direct image sensor captures all three colors at every pixel location and requires special software to manipulate the RAW files.

BAY – Kodak/Roper Bayer Picture Sequence. A specific Kodak picture format used by some high speed video cameras such as Kodak HRC-1000.

Important Links

Advice

Stop using the hard drive as soon as possible. If the problem is getting worse then you may eventually lose access completely.

Don't download ANYTHING to the disk. It could write over the files you're trying to recover.

Don't try to scan, repair or fix any errors unless you have backups of the data. A failed repair process can damage the files beyond recovery.

Don't re-install or restore the computer unless you have backups of the data already. It may get the machine running again, but only in a factory-fresh way. Your data will be lost.

If you manage to access your files at any point, make a copy to another drive as soon as you can. It may be a fluke, and could be the last time you see the files. Don't reboot expecting to see them again.

If the files you need are really important then you should consider getting the disk professionally recovered. We've spent years making our process as safe as possible to maximise our chances of success.

If you decide to try your own recovery, keep a close watch on the time estimates. If the time keeps incrementing up it could be a sign of disk trouble. Failure to deal with that could cause the drive to fail completely, and beyond repair. A hard drive shouldn't take longer than a few hours to extract.